US10769278B2 - Service identification of ransomware impact at account level - Google Patents
Service identification of ransomware impact at account level Download PDFInfo
- Publication number
- US10769278B2 US10769278B2 US15/941,243 US201815941243A US10769278B2 US 10769278 B2 US10769278 B2 US 10769278B2 US 201815941243 A US201815941243 A US 201815941243A US 10769278 B2 US10769278 B2 US 10769278B2
- Authority
- US
- United States
- Prior art keywords
- files
- storage account
- ransomware
- storage
- account
- Prior art date
- Legal status (The legal status is an assumption and is not a legal conclusion. Google has not performed a legal analysis and makes no representation as to the accuracy of the status listed.)
- Active, expires
Links
- 238000003860 storage Methods 0.000 claims abstract description 393
- 230000000694 effects Effects 0.000 claims abstract description 87
- 238000005067 remediation Methods 0.000 claims abstract description 43
- 238000000034 method Methods 0.000 claims description 55
- 238000012790 confirmation Methods 0.000 claims description 39
- 238000001514 detection method Methods 0.000 claims description 27
- 230000015654 memory Effects 0.000 claims description 21
- 238000011084 recovery Methods 0.000 claims description 16
- 230000004044 response Effects 0.000 claims description 15
- 238000010801 machine learning Methods 0.000 claims description 10
- 238000012549 training Methods 0.000 claims description 5
- 238000004458 analytical method Methods 0.000 description 58
- 238000004891 communication Methods 0.000 description 25
- 238000013500 data storage Methods 0.000 description 22
- 238000010586 diagram Methods 0.000 description 16
- 230000006870 function Effects 0.000 description 12
- 238000012545 processing Methods 0.000 description 6
- 230000005540 biological transmission Effects 0.000 description 5
- 230000004048 modification Effects 0.000 description 5
- 238000012986 modification Methods 0.000 description 5
- 238000000605 extraction Methods 0.000 description 4
- 230000006872 improvement Effects 0.000 description 4
- 230000005291 magnetic effect Effects 0.000 description 4
- 230000003287 optical effect Effects 0.000 description 3
- 238000012360 testing method Methods 0.000 description 3
- 238000007792 addition Methods 0.000 description 2
- 230000001413 cellular effect Effects 0.000 description 2
- 230000001010 compromised effect Effects 0.000 description 2
- 238000005516 engineering process Methods 0.000 description 2
- 239000000284 extract Substances 0.000 description 2
- 208000015181 infectious disease Diseases 0.000 description 2
- 230000000644 propagated effect Effects 0.000 description 2
- 230000003068 static effect Effects 0.000 description 2
- 238000003491 array Methods 0.000 description 1
- 230000008859 change Effects 0.000 description 1
- 230000006835 compression Effects 0.000 description 1
- 238000007906 compression Methods 0.000 description 1
- 238000001816 cooling Methods 0.000 description 1
- 230000007274 generation of a signal involved in cell-cell signaling Effects 0.000 description 1
- 239000004973 liquid crystal related substance Substances 0.000 description 1
- 230000007246 mechanism Effects 0.000 description 1
- 230000002093 peripheral effect Effects 0.000 description 1
- 230000008569 process Effects 0.000 description 1
- 239000004065 semiconductor Substances 0.000 description 1
- 239000000126 substance Substances 0.000 description 1
- 238000006467 substitution reaction Methods 0.000 description 1
- 230000001360 synchronised effect Effects 0.000 description 1
- 238000012546 transfer Methods 0.000 description 1
- 238000010200 validation analysis Methods 0.000 description 1
- 230000000007 visual effect Effects 0.000 description 1
Images
Classifications
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/566—Dynamic detection, i.e. detection performed at run-time, e.g. emulation, suspicious activities
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/10—File systems; File servers
- G06F16/16—File or folder operations, e.g. details of user interfaces specifically adapted to file systems
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F16/00—Information retrieval; Database structures therefor; File system structures therefor
- G06F16/20—Information retrieval; Database structures therefor; File system structures therefor of structured data, e.g. relational data
- G06F16/23—Updating
- G06F16/2358—Change logging, detection, and notification
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/552—Detecting local intrusion or implementing counter-measures involving long-term monitoring or reporting
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/554—Detecting local intrusion or implementing counter-measures involving event detection and direct action
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/562—Static detection
- G06F21/565—Static detection by checking file integrity
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06F—ELECTRIC DIGITAL DATA PROCESSING
- G06F21/00—Security arrangements for protecting computers, components thereof, programs or data against unauthorised activity
- G06F21/50—Monitoring users, programs or devices to maintain the integrity of platforms, e.g. of processors, firmware or operating systems
- G06F21/55—Detecting local intrusion or implementing counter-measures
- G06F21/56—Computer malware detection or handling, e.g. anti-virus arrangements
- G06F21/568—Computer malware detection or handling, e.g. anti-virus arrangements eliminating virus, restoring damaged files
-
- G—PHYSICS
- G06—COMPUTING; CALCULATING OR COUNTING
- G06N—COMPUTING ARRANGEMENTS BASED ON SPECIFIC COMPUTATIONAL MODELS
- G06N20/00—Machine learning
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1408—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic by monitoring network traffic
- H04L63/1416—Event detection, e.g. attack signature detection
-
- H—ELECTRICITY
- H04—ELECTRIC COMMUNICATION TECHNIQUE
- H04L—TRANSMISSION OF DIGITAL INFORMATION, e.g. TELEGRAPHIC COMMUNICATION
- H04L63/00—Network architectures or network communication protocols for network security
- H04L63/14—Network architectures or network communication protocols for network security for detecting or protecting against malicious traffic
- H04L63/1441—Countermeasures against malicious traffic
Definitions
- the subject matter disclosed herein generally relates to a special-purpose machine that detects ransomware-impacted files in a storage account of a cloud storage system and improves the detection of ransomware-impacted files in the storage account, including computerized variants of such special-purpose machines and improvements to such variants, and to the technologies by which such special-purpose machines become improved compared to other special-purpose machines that detect ransomware.
- the present disclosure addresses systems and methods that detect a ransomware-impacted account in a cloud storage system and provide recovery options.
- a ransomware attack on a computer modifies some files stored on the computer by encrypting the content of the files and holding the encrypted files for ransom.
- a user of the computer may not have other recourse to recover the encrypted files besides paying the ransom. If the ransom is not paid within a specified time, the files are permanently lost.
- FIG. 1 is a block diagram illustrating an example environment for detecting ransomware-impacted files in accordance with an example embodiment.
- FIG. 2 is a block diagram illustrating components within a storage system in accordance with an example embodiment.
- FIG. 3 is a block diagram illustrating components within a ransomware analysis engine in accordance with an example embodiment.
- FIG. 4 is a flow diagram of a method for detecting ransomware activity in accordance with an example embodiment.
- FIG. 5 is a flow diagram of a method for detecting ransomware activity in accordance with another example embodiment.
- FIG. 6 is a flow diagram of a method for determining ransomware activity in a storage system in accordance with an example embodiment.
- FIG. 7 is a flow diagram of a method for providing recovery options to remediate ransomware activity in an account of a storage system in accordance with an example embodiment.
- FIG. 8 is a diagrammatic representation of a machine in an example form of a computing system within which a set of instructions may be executed for causing the machine to perform any one or more of the methodologies discussed herein, according to an example embodiment.
- Example methods e.g., algorithms
- systems e.g., special-purpose machines
- the files stored in the storage account at the cloud storage system (also referred to as cloud storage server) are synced to a drive or folder at a corresponding client device registered with the cloud storage server.
- the files are stored only in the storage account in the cloud storage server (and not at the corresponding client device).
- the cloud storage system performs a series of tests on the files in the storage account to determine whether the storage account is compromised by ransomware activity.
- Examples of tests include computing a file churn based on changes to one or more files in the storage account within a predefined period of time, computing a number of files being encrypted within the predefined period of time, identifying a name extension and a naming pattern for the one or more files in the storage account, identifying a content type for the one or more files in the storage account, accessing results from anti-malware applications operating on the client device, and using machine learning based on user feedback to determine whether the files are impacted by ransomware.
- the cloud storage server determines that the storage account is compromised by ransomware, the cloud storage server notifies the corresponding client device and presents an option to the client device to remediate the ransomware attack by restoring the impacted files to a previous (non-impacted) version of the files prior to the ransomware attack.
- a cloud storage server determines features of files in a storage account of the cloud storage server.
- the storage account is registered with a client device.
- the cloud storage server detects ransomware activity based on the features of the files.
- a notification is generated to the client device.
- the notification indicates the detected ransomware activity in the storage account, and one or more remediation options for the detected ransomware activity in the storage account.
- the cloud storage server receives, from the client device, a remediation option selected from the one or more remediation options and recovers one or more files in the storage account based on the selected remediation option.
- one or more of the methodologies described herein facilitate solving the technical problem of identifying storage accounts (in a cloud storage server) that are affected by ransomware and providing remediation options to the client device.
- one or more of the methodologies described herein may obviate a need for certain efforts or computing resources that otherwise would be involved in preventing an attack and generating false positives of ransomware detection in any of the files.
- resources used by one or more machines, databases, or devices may be reduced. Examples of such computing resources include processor cycles, network traffic, memory usage, data storage capacity, power consumption, network bandwidth, and cooling capacity.
- the present application minimizes any disruption to the user's workflow. If there are uninfected devices connected to cloud storage, these devices can sync their files without interruption. If the present detection is wrong, the user can ignore it. There is no added latency to file writes because the detection is asynchronous (i.e. because the file changes are permitted to occur).
- the cloud storage server receives a larger set of changes which may be malicious.
- the extra data potentially in conjunction with user feedback, makes the malware detection more effective.
- the detection can be executed using fewer system resources than a synchronous detection, thus making it less expensive.
- FIG. 1 is a block diagram illustrating an example environment 100 for detecting ransomware-impacted files in accordance with an example embodiment.
- a storage system 106 stores copies of files from a client device 102 .
- the storage system 106 will be discussed in more detail in connection with FIG. 2 below.
- the storage system 106 is coupled, via a network 104 , to one or more client devices (e.g., the client device 102 ).
- One or more portions of the network 104 may be an ad hoc network, an intranet, an extranet, a virtual private network (VPN), a local area network (LAN), a wireless LAN (WLAN), a wide area network (WAN), a wireless WAN (WWAN), a metropolitan area network (MAN), a portion of the Internet, a portion of the Public Switched Telephone Network (PSTN), a cellular telephone network, a wireless network, a Wi-Fi network, a WiMax network, a satellite network, a cable network, a broadcast network, another type of network, or a combination of two or more such networks.
- VPN virtual private network
- LAN local area network
- WLAN wireless LAN
- WAN wide area network
- WWAN wireless WAN
- MAN metropolitan area network
- PSTN Public Switched Telephone Network
- PSTN Public Switched Telephone Network
- transmission medium refers to any intangible (e.g., transitory) medium that is capable of communicating (e.g., transmitting) instructions for execution by a machine (e.g., by one or more processors of such a machine), and includes digital or analog communication signals or other intangible media to facilitate communication of such software.
- the client device 102 includes a client storage application 108 configured to communicate files (e.g., send and receive copies of files) or modifications to the files with a storage account of the client device 102 at the storage system 106 .
- the client storage application 108 syncs local files stored in a preset directory or folder at the client device 102 with files stored in a corresponding directory or folder of the storage account at the storage system 106 . Therefore, changes made to a local file in the preset folder of the client device 102 are propagated to a corresponding remote file (a copy of the local file) at the storage system 106 .
- the client storage application 108 registers the client device 102 with the storage system 106 and communicates copies of the user-selected local files at the client device 102 to the storage system 106 .
- changes made to a remote file at the storage system 106 are propagated to a corresponding local file at the client device 102 .
- the storage system 106 detects whether the storage account of the client device 102 (or the client storage application 108 ) at the storage system 106 is impacted (also referred to as “infected”) by ransomware (or malware). The storage system 106 generates a notification to the client storage application 108 that the storage account has been impacted by ransomware and provides remediation options to the client device 102 . In another example embodiment, the storage system 106 receives user feedback (e.g., validation/confirmation) from the client storage application 108 that provides additional reference data to a learning engine of the storage system 106 to increase its accuracy in detecting future ransomware activity at the storage system 106 and avoiding false positives.
- user feedback e.g., validation/confirmation
- the client device 102 comprises, but is not limited to, a smartphone, tablet, laptop, multi-processor system, microprocessor-based or programmable consumer electronics system, game console, set-top box, or any other device that a user utilizes to communicate over the network 104 .
- the client device 102 comprises a display module (not shown) to display information (e.g., in the form of specially configured user interfaces).
- the client device 102 may comprise one or more of a touch screen, camera, keyboard, microphone, and Global Positioning System (GPS) device.
- GPS Global Positioning System
- any of the systems or machines (e.g., databases, devices, servers) shown in, or associated with, FIG. 1 may be, include, or otherwise be implemented in a special-purpose (e.g., specialized or otherwise non-generic) computer that has been modified (e.g., configured or programmed by software, such as one or more software modules of an application, operating system, firmware, middleware, or other program) to perform one or more of the functions described herein for that system or machine.
- a special-purpose computer system able to implement any one or more of the methodologies described herein is discussed below with respect to FIG. 8 , and such a special-purpose computer may accordingly be a means for performing any one or more of the methodologies discussed herein.
- a special-purpose computer that has been modified by the structures discussed herein to perform the functions discussed herein is technically improved compared to other special-purpose computers that lack the structures discussed herein or are otherwise unable to perform the functions discussed herein. Accordingly, a special-purpose machine configured according to the systems and methods discussed herein provides an improvement to the technology of similar special-purpose machines.
- any two or more of the systems or machines illustrated in FIG. 1 may be combined into a single system or machine, and the functions described herein for any single system or machine may be subdivided among multiple systems or machines.
- any number and types of client devices 102 may be embodied within the environment 100 .
- some components or functions of the environment 100 may be combined or located elsewhere in the environment 100 .
- some of the functions of the client storage application 108 may be embodied at the storage system 106 .
- FIG. 2 is a block diagram illustrating components within a storage system 106 in accordance with an example embodiment.
- the storage system 106 performs operations to detect and identify storage accounts impacted by ransomware, generates a notification of the ransomware attack to a client device corresponding to the storage account impacted by the ransomware attack, provides remediation options to the client device, receives a recovery selection from the client device, and operates on the storage account based on the recovery selection.
- the storage system 106 comprises a server storage application 202 , a data storage 206 , a ransomware analysis engine 210 , a notification engine 214 , and a communication module 216 , all of which are configured to communicate with each other (e.g., over a bus, shared memory, or a switch) in accordance with an example embodiment.
- the server storage application 202 is configured to interface and communicate with the communication module 216 .
- the server storage application 202 receives a request to modify the storage account at the data storage 206 from the client storage application 108 .
- the server storage application 202 may also receive a request from the client storage application 108 to add a new file in the data storage 206 or to replace an existing corresponding file with a modified file in the data storage 206 .
- the server storage application 202 receives and sends copies of files between the storage system 106 and the client device 102 .
- the server storage application 202 is configured with the client storage application 108 to store one or more versions of copies of files received from the client storage application 108 at the storage account associated with the client storage application 108 .
- the server storage application 202 registers the client storage application 108 and forms a folder or a directory (that corresponds to a user-selected folder or directory at the client device 102 ) associated with the storage account of the client device 102 at the storage system 106 .
- the server storage application 202 identifies historical changes to a file stored at the storage system 106 based on the different versions of the file received from the client storage application 108 .
- the server storage application 202 stores file changes 204 (e.g., a new file or a modified file) in the storage account of the client storage application 108 at the data storage 206 .
- the data storage 206 is configured to store the files (e.g., file changes 204 ) received from the server storage application 202 .
- the data storage 206 is configured to store several versions of the files based on the dates and times of the different versions of the files.
- the files may include attributes such as file name, file extension, and size. Those of ordinary skill in the art will recognize that the files can include other different types of attributes.
- the data storage 206 is configured to store files and account information for individual users/storage accounts in user-specific data stores (or storage account-specific data stores) or databases (hereinafter collectively referred to as a “user data structure”).
- user data structure may correspond to a folder and/or a directory of the client device 102 of a user.
- the data storage 206 is shown to be a part of the storage system 106 , in some embodiments, the data storage 206 may be located elsewhere in the environment 100 and be communicatively coupled to the storage system 106 . Additionally, any number of data storages 206 may be used to store the user data structures.
- the data storage 206 provides account file features 208 of one or more files in the storage account of the client device 102 to the ransomware analysis engine 210 . In another example embodiment, the data storage 206 provides copies of one or more files (or all files) associated with the storage account of the client device 102 to the ransomware analysis engine 210 .
- the ransomware analysis engine 210 performs a series of tests on the storage account (e.g., on one or more files in the storage account or using the account file features 208 ) to detect whether the storage account is impacted by ransomware.
- the ransomware analysis engine 210 will be discussed in more detail in connection with FIG. 3 below.
- the ransomware analysis engine 210 determines that the storage account is impacted by ransomware, the ransomware analysis engine 210 provides an identification of the storage account and the suspicious files in that storage account (e.g., identified files/user account 212 ) to the notification engine 214 .
- the notification engine 214 identifies the client storage application 108 associated with the ransomware-compromised storage account and generates a notification 215 that notifies the client storage application 108 that the storage account and the identified files are impacted by ransomware.
- the notification 215 includes a request for the client storage application 108 to confirm that the storage account and the identified files (at the data storage 206 ) are indeed impacted by ransomware.
- the notification 215 includes remediation options for the client storage application 108 .
- the remediation options include several ways to address the ransomware attack such as restoring the ransomware-impacted files in the storage account to a previous version of the ransomware-impacted files.
- the notification 215 includes, for example, an identification of the storage account and the suspicious files, a time of the suspected infection, a version identification of the suspicious files, an identification of who last modified the suspicious files, and an identification of the name of the suspected ransomware (or malware).
- the notification engine 214 provides the notification 215 to the communication module 216 .
- the communication module 216 is configured to exchange communications with the client device 102 . For example, the communication module 216 transmits the notification 215 to the client storage application 108 . In one example embodiment, the communication module 216 receives a ransomware confirmation 220 from the client storage application 108 . The ransomware confirmation indicates whether a user (of the storage account) confirms that the storage account is indeed impacted by ransomware. The communication module 216 forwards the user feedback (e.g., the ransomware confirmation 220 ) to the ransomware analysis engine 210 . In another example embodiment, the communication module 216 receives a selected recovery 222 (selected from the remediation options) from the client storage application 108 and communicates the selected recovery 222 to the server storage application 202 .
- a selected recovery 222 selected from the remediation options
- the server storage application 202 restores the storage account based on the selected recovery 222 (e.g., restoring the files to a previous version, deleting some of the files, restoring the files based on a non-impacted file in a recycle bin of the storage account).
- the communication module 216 includes a user interface module (not shown) that is configured to cause presentation of specially configured user interfaces on the client device 102 that include a visual indication of the ransomware-impacted storage account, the impacted files, and other pertinent information (e.g., time of infection, last modified author, size change).
- the user interface module generates and transmits instructions to the client storage application 108 to render and display the user interfaces.
- any one or more of the components (e.g., modules, engines) described herein may be implemented using hardware alone (e.g., one or more processors of a machine) or a combination of hardware and software.
- any component described herein may physically include an arrangement of one or more of the processors or configure a processor (e.g., among one or more processors of a machine) to perform the operations described herein for that component.
- different components described herein may include and configure different arrangements of the processors at different points in time or a single arrangement of the processors at different points in time.
- Each component (e.g., module) described herein is an example of a means for performing the operations described herein for that component.
- any two or more of these components may be combined into a single component, and the functions described herein for a single component may be subdivided among multiple components.
- components described herein as being implemented within a single machine, database, or device may be distributed across multiple machines, databases, or devices.
- the storage system 106 may comprise other components not pertinent to example embodiments that are not shown or discussed. Further still, one or more of the components of the storage system 106 may be located at one or more of the client devices.
- FIG. 3 is a block diagram illustrating components within a ransomware analysis engine 210 in accordance with an example embodiment.
- the ransomware analysis engine 210 performs operations to detect and identify ransomware-impacted files stored in the data storage 206 .
- the ransomware analysis engine 210 comprises a feature extraction module 302 , a file churn analysis module 303 , an encryption analysis module 304 , a file naming analysis module 306 , a content analysis module 308 , a user feedback module 312 , a learning engine 314 , an impacted file identification module 310 , and a client-side ransomware detection module 316 , all of which are configured to communicate with each other (e.g., over a bus, shared memory, or a switch) in accordance with an example embodiment.
- the feature extraction module 302 extracts features from files in the storage account at the data storage 206 .
- the feature extraction module 302 extracts features from a last modified file or a new file received from the client storage application 108 via the server storage application 202 .
- Examples of features include, but are not limited to, attributes of the files such as file encryption status, name extension, date of creation, date of modification, versioning number, author name, type of media, and compression status.
- the file churn analysis module 303 calculates a file churn as the number of files that have been modified during a predefined period of time (e.g., during the last 24 hours), as a raw number (e.g., 100 files have changed) or as a percentage of the account size (e.g., 5% of the files in the storage account have changed).
- the file churn analysis module 303 provides the file churn of the files of the storage account to the impacted file identification module 310 .
- the encryption analysis module 304 determines the encryption status of the files in the storage account based on the extracted features of the files. For example, the encryption analysis module 304 determines that the encryption status of the modified files have changed (e.g., from unencrypted to encrypted: a modified file is now encrypted whereas a previous version of the corresponding file is unencrypted). In another example, the encryption analysis module 304 determines that a new file is encrypted. The encryption analysis module 304 provides the encryption status of the files to the impacted file identification module 310 .
- the file naming analysis module 306 determines the names and the name extensions of the files based on the extracted features of the files in the storage account. For example, the file naming analysis module 306 compares the name of one of the files with the name of known ransomware. In another example embodiment, the file naming analysis module 306 determines whether there is an increase in file renames in the storage account. In other example embodiments, the file naming analysis module 306 monitors for text strings associated with known ransomware. The file naming analysis module 306 provides the results of its analysis to the impacted file identification module 310 .
- the content analysis module 308 determines whether content of a file from the storage account does not match its corresponding file type (e.g., based on its name extension). For example, the content analysis module 308 determines that the content in a .jpg file is not an image. The content analysis module 308 provides its content analysis result of the files of the storage account to the impacted file identification module 310 .
- the user feedback module 312 is configured to receive feedback (e.g., confirmation of the presence of ransomware in the storage account) from the client storage application 108 of the client device 102 .
- the user feedback module 312 receives a ransomware confirmation from the client storage application 108 based on user feedback at the client storage application 108 .
- the user feedback indicates whether one or more files of the storage account (or whether the storage account) are indeed impacted by ransomware.
- the user feedback module 312 provides the user feedback (e.g., ransomware confirmation) to the learning engine 314 .
- the learning engine 314 (e.g., a machine learning algorithm) manages a learning model for identifying ransomware files.
- the learning engine 314 accesses file information (associated with the client device 102 and other client devices) from the data storage 206 .
- the file information includes attributes, extensions, and features (including user feedback) of old, new, and modified files associated with the client device 102 and other client devices.
- the learning engine 314 can identify trends or patterns. For example, the learning engine 314 learns, based on file extensions, that the new file is actually not related to ransomware, as confirmed by the user of the client device 102 , because the user has given the file a name associated with known ransomware.
- the learning engine 314 learns that a file that is encrypted and has a file name extension with a particular naming pattern (e.g., previously associated with existing ransomware) is likely affected by ransomware.
- the learning engine 314 can, in one embodiment, suggest to the impacted file identification module 310 that the storage account is or is not likely affected by ransomware. In a further embodiment, the learning engine 314 updates a list of files that have been confirmed or validated as safe (non-impacted by ransomware) from the client device 102 or other client devices. All of the trends or patterns identified by the learning engine 314 may be stored in the data storage 206 and provided to the impacted file identification module 310 for further processing.
- the learning engine 314 determines the number of files (in the account of the client device 102 in the data storage 206 ) being updated, deleted, created, and encrypted, and with suspicious extensions, and generates a determination or confidence level that the storage account is impacted by a malware or ransomware attack.
- the client-side ransomware detection module 316 accesses results or notifications from a client-based ransomware application (not shown) operating at the client device 102 . For example, the client-side ransomware detection module 316 receives a notification that a particular file corresponding to a file in the storage account has been flagged as a suspicious file. The client-side ransomware detection module 316 provides that notification to the impacted file identification module 310 .
- the impacted file identification module 310 receives the results from the file churn analysis module 303 , the encryption analysis module 304 , the file naming analysis module 306 , the content analysis module 308 , the learning engine 314 , and the client-side ransomware detection module 316 to assess and determine whether the storage account is likely impacted by ransomware.
- the impacted file identification module 310 provides a range of confidence that the storage account is impacted by ransomware.
- the impacted file identification module 310 determines that the storage account is likely impacted by ransomware based on a determination that the file churn exceeds a preset churn rate (e.g., more than 10% of the files in the storage account have been modified within a short window of time—e.g., an hour), that a large number of files (e.g., larger than a preset number such as 10 files) are now encrypted and that their corresponding previous versions were not unencrypted, and that one or more files in the storage account have already been flagged by a client-based ransomware application at the client device 102 .
- a preset churn rate e.g., more than 10% of the files in the storage account have been modified within a short window of time—e.g., an hour
- a large number of files e.g., larger than a preset number such as 10 files
- FIG. 4 is a flow diagram of a method 400 for detecting ransomware activity in accordance with an example embodiment.
- Operations in the method 400 may be performed by the storage system 106 , using components (e.g., modules, engines) described above with respect to FIG. 2 . Accordingly, the method 400 is described by way of example with reference to the storage system 106 . However, it shall be appreciated that at least some of the operations of the method 400 may be deployed on various other hardware configurations or be performed by similar components residing elsewhere. For example, some of the operations may be performed at the client device 102 .
- the storage system 106 receives, from the client device 102 , a request to modify files stored in the storage account of the client device 102 at the storage system 106 .
- the request to modify files include modifying an existing file in the storage account in the storage system 106 or adding a new file to the storage account in the storage system 106 .
- the storage system 106 receives the request via the server storage application 202 and the communication module 216 .
- the server storage application 202 accesses the user data structure (e.g., files, folder, directory) of the storage account of the client device 102 at the data storage 206 and stores the new file or modifies an existing file in the user data structure (to generate modified files).
- the user data structure e.g., files, folder, directory
- the ransomware analysis engine 210 determines features of the files of the storage account. Examples of features include a file churn rate of files in the storage account, an encryption status of files in the storage account, a file or extension naming pattern, a content analysis matching result, and user feedback (e.g., previous feedback from the user of the client device 102 or users of other client devices) related to the files in the storage account (or other files in other storage accounts).
- features include a file churn rate of files in the storage account, an encryption status of files in the storage account, a file or extension naming pattern, a content analysis matching result, and user feedback (e.g., previous feedback from the user of the client device 102 or users of other client devices) related to the files in the storage account (or other files in other storage accounts).
- ransomware analysis engine 210 detects ransomware (e.g., also referred to as “malware”) activity based on the features of the files of the storage account.
- ransomware e.g., also referred to as “malware”
- the notification engine 214 In operation 410 , the notification engine 214 generates a notification that identifies the storage account as being impacted by ransomware.
- the communication module 216 sends the notification to the client storage application 108 .
- the ransomware analysis engine 210 receives a confirmation of the ransomware activity at the storage account from the client storage application 108 via the communication module 216 .
- FIG. 5 is a flow diagram of a method 500 for detecting ransomware activity in accordance with another example embodiment.
- Operations in the method 500 may be performed by the ransomware analysis engine 210 , using components (e.g., modules, engines) described above with respect to FIG. 3 . Accordingly, the method 500 is described by way of example with reference to the ransomware analysis engine 210 . However, it shall be appreciated that at least some of the operations of the method 500 may be deployed on various other hardware configurations or be performed by similar components residing elsewhere. For example, some of the operations may be performed at the client device 102 .
- the file churn analysis module 303 computes a file churn based on the number of file changes in a storage account during a predefined period of time.
- the ransomware analysis engine 210 determines whether the file churn exceeds a preset churn threshold for the predefined period of time (e.g., more than 50% of files have changed within a 24-hour period).
- the encryption analysis module 304 identifies an encryption status of files in the storage account. For example, the encryption analysis module 304 determines how many files (that were not encrypted) are now encrypted. In another example embodiment, the encryption analysis module 304 determines how many files have become encrypted within a predefined period of time (e.g., the last 24 hours). In another example embodiment, the predefined period of time from the encryption analysis module 304 is the same as the predefined period of time from the file churn analysis module 303 . In another example embodiment, the predefined period of time from the encryption analysis module 304 may be different in time duration and dates from the predefined period of time from the file churn analysis module 303 .
- the file naming analysis module 306 identifies file names of the files in the storage account.
- the file naming analysis module 306 identifies file name extensions of files in the storage account.
- the content analysis module 308 identifies a content type of the files in the storage account. For example, the content analysis module 308 determines whether the content of the files matches with the name extensions of the corresponding files.
- the user feedback module 312 identifies previous user feedback related to the files in the storage account.
- the client-side ransomware detection module 316 accesses the results of a client-based ransomware detection application operating at the client device 102 .
- the impacted file identification module 310 determines ransomware activity in the storage account based on the file churn, the encryption status, the file name, the extension, the content type, the previous user feedback, and results from the client-based ransomware detection application.
- FIG. 6 is a flow diagram of a method 600 for determining ransomware activity in a storage system in accordance with another example embodiment.
- Operations in the method 600 may be performed by the ransomware analysis engine 210 , using components (e.g., modules, engines) described above with respect to FIG. 3 . Accordingly, the method 600 is described by way of example with reference to the ransomware analysis engine 210 . However, it shall be appreciated that at least some of the operations of the method 600 may be deployed on various other hardware configurations or be performed by similar components residing elsewhere. For example, some of the operations may be performed at the client device 102 .
- the user feedback module 312 receives previous user feedback (or other users' feedback) related to the files of the storage account stored at the storage system 106 .
- the learning engine 314 trains a ransomware detection model for the storage account based on the user feedback.
- the feature extraction module 302 determines features of the files in the storage account. Examples of features include a file churn, an encryption status, a file or extension naming pattern, a content analysis matching result, and user feedback related to files similar to files in the storage account.
- the impacted file identification module 310 detects ransomware activity (e.g., ransomware) based on the features of the files in the storage account as previously determined in operation 606 and based on the ransomware detection model as previously determined in operation 604 .
- ransomware activity e.g., ransomware
- the notification engine 214 In operation 610 , the notification engine 214 generates a notification that identifies the storage account and the impacted files in the storage account (based on the impacted file identification from operation 608 ) as potentially affected by ransomware to the client device 102 .
- the communication module 216 sends the notification to the client storage application 108 .
- the user feedback module 312 receives a confirmation of the ransomware activity at the storage account from the client device 102 via the communication module 216 .
- the user feedback module 312 receives the confirmation and provides the confirmation as training data to the learning engine 314 .
- FIG. 7 is a flow diagram of a method 700 for providing recovery options to remediate ransomware activity in an account of a storage system in accordance with an example embodiment.
- Operations in the method 700 may be performed by the storage system 106 , using components (e.g., modules, engines) described above with respect to FIG. 2 . Accordingly, the method 700 is described by way of example with reference to the storage system 106 . However, it shall be appreciated that at least some of the operations of the method 700 may be deployed on various other hardware configurations or be performed by similar components residing elsewhere. For example, some of the operations may be performed at the client device 102 .
- the notification engine 214 generates the notification 215 to the client device 102 .
- the notification 215 includes a detection notification that indicates that the storage account (or one or more files in the storage account) has been impacted by ransomware, and a remediation notification that provides recovery options to the user of the client device 102 .
- the communication module 216 communicates the notification 215 to the client storage application 108 .
- the communication module 216 receives the selected recovery option from the client storage application 108 .
- the communication module 216 provides the selected recovery option to the server storage application 202 .
- the server storage application 202 operates to remediate the storage account based on the selected recovery option, for example, by recovering previous versions (non-impacted versions) of the impacted files from the data storage 206 .
- FIG. 8 is a block diagram illustrating components of a machine 800 , according to some example embodiments, able to read instructions 824 from a machine-storage medium 822 and perform any one or more of the methodologies discussed herein, in whole or in part.
- FIG. 8 shows the machine 800 in the example form of a computer device (e.g., a computer) within which the instructions 824 (e.g., software, a program, an application, an applet, an app, or other executable code) for causing the machine 800 to perform any one or more of the methodologies discussed herein may be executed, in whole or in part.
- the instructions 824 e.g., software, a program, an application, an applet, an app, or other executable code
- the instructions 824 may cause the machine 800 to execute the flows and flow diagrams of FIGS. 4, 5, 6, and 7 .
- the instructions 824 can transform the general, non-programmed machine 800 into a particular machine (e.g., specially configured machine) programmed to carry out the described and illustrated functions in the manner described.
- the machine 800 operates as a standalone device or may be connected (e.g., networked) to other machines.
- the machine 800 may be a server computer, a client computer, a personal computer (PC), a tablet computer, a laptop computer, a netbook, a set-top box (STB), a personal digital assistant (PDA), a cellular telephone, a smartphone, a web appliance, a network router, a network switch, a network bridge, a power adapter, or any machine 800 capable of executing the instructions 824 , sequentially or otherwise, that specify actions to be taken by that machine 800 .
- the term “machine” shall also be taken to include a collection of machines that individually or jointly execute the instructions 824 to perform any one or more of the methodologies discussed herein.
- the machine 800 includes a processor 802 (e.g., a central processing unit (CPU), a graphics processing unit (GPU) 803 , a digital signal processor (DSP), an application specific integrated circuit (ASIC), a radio-frequency integrated circuit (RFIC), or any suitable combination thereof), a main memory 804 , and a static memory 806 , which are configured to communicate with each other via a bus 808 .
- the processor 802 may contain microcircuits that are configurable, temporarily or permanently, by some or all of the instructions 824 such that the processor 802 is configurable to perform any one or more of the methodologies described herein, in whole or in part.
- a set of one or more microcircuits of the processor 802 may be configurable to execute one or more modules (e.g., software modules) described herein.
- the machine 800 may further include a display device 810 (e.g., a plasma display panel (PDP), a light-emitting diode (LED) display, a liquid crystal display (LCD), a projector, a cathode ray tube (CRT), or any other display capable of displaying graphics or video).
- a display device 810 e.g., a plasma display panel (PDP), a light-emitting diode (LED) display, a liquid crystal display (LCD), a projector, a cathode ray tube (CRT), or any other display capable of displaying graphics or video).
- PDP plasma display panel
- LED light-emitting diode
- LCD liquid crystal display
- CTR cathode ray tube
- the machine 800 may also include an alphanumeric input device 812 (e.g., a keyboard or keypad), a user interface (UI) navigation device 814 (e.g., a mouse, a touchpad, a trackball, a joystick, a motion sensor, an eye tracking device, or another pointing instrument), a storage unit 816 , a signal generation device 818 (e.g., a sound card, an amplifier, a speaker, a headphone jack, or any suitable combination thereof), a network interface device 820 , and one or more sensors 821 , such as a Global Positioning System (GPS) sensor, compass, accelerometer, or another sensor.
- GPS Global Positioning System
- the machine 800 may include an output controller 828 , such as a serial (e.g., universal serial bus (USB)), parallel, or other wired or wireless (e.g., infrared (IR), near field communication (NFC), etc.) connection to communicate with or control one or more peripheral devices (e.g., a printer, card reader, etc.).
- a serial e.g., universal serial bus (USB)
- parallel e.g., parallel
- wired or wireless e.g., infrared (IR), near field communication (NFC), etc.
- peripheral devices e.g., a printer, card reader, etc.
- the storage unit 816 includes the machine-storage medium 822 on which are stored the instructions 824 embodying any one or more of the methodologies or functions described herein.
- the instructions 824 may also reside, completely or at least partially, within the processor 802 , the GPU 803 , main memory 804 , the static memory 806 , or the machine storage medium 822 before or during execution thereof by the machine 800 . Accordingly, the main memory 804 and the processor 802 may be considered machine-storage media 822 (e.g., tangible and non-transitory machine-readable media).
- the machine 800 may be a portable computing device and have one or more additional input components (e.g., sensors or gauges).
- additional input components e.g., sensors or gauges.
- input components include an image input component (e.g., one or more cameras), an audio input component (e.g., a microphone), a direction input component (e.g., a compass), a location input component (e.g., a Global Positioning System (GPS) receiver), an orientation component (e.g., a gyroscope), a motion detection component (e.g., one or more accelerometers), an altitude detection component (e.g., an altimeter), and a gas detection component (e.g., a gas sensor).
- Inputs harvested by any one or more of these input components may be accessible and available for use by any of the modules described herein.
- the various memories i.e., 804 , 806 , and/or the memory of the processor(s) 802
- the storage unit 816 may store one or more sets of instructions 824 and data structures (e.g., software) embodying or utilized by any one or more of the methodologies or functions described herein. These instructions, when executed by the processor(s) 802 , cause various operations to implement the disclosed embodiments.
- machine-storage medium As used herein, the terms “machine-storage medium,” “device-storage medium,” and “computer-storage medium” (referred to collectively as “machine-storage medium”) mean the same thing and may be used interchangeably in this disclosure.
- the terms refer to a single or multiple storage devices and/or media (e.g., a centralized or distributed database, and/or associated caches and servers) that store executable instructions and/or data, as well as cloud-based storage systems or storage networks that include multiple storage apparatus or devices.
- the terms shall accordingly be taken to include, but not be limited to, solid-state memories, and optical and magnetic media, including memory internal or external to processors.
- machine-storage media, computer-storage media, and/or device-storage media 822 include non-volatile memory, including by way of example semiconductor memory devices, e.g., erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), field-programmable gate arrays (FPGAs), and flash memory devices; magnetic disks such as internal hard disks and removable disks; magneto-optical disks; and CD-ROM and DVD-ROM disks.
- semiconductor memory devices e.g., erasable programmable read-only memory (EPROM), electrically erasable programmable read-only memory (EEPROM), field-programmable gate arrays (FPGAs), and flash memory devices
- magnetic disks such as internal hard disks and removable disks
- magneto-optical disks and CD-ROM and DVD-ROM disks.
- CD-ROM and DVD-ROM disks CD-ROM and DVD-ROM disks.
- signal medium or “transmission medium” shall be taken to include any form of modulated data signal, carrier wave, and so forth.
- modulated data signal means a signal that has one or more of its characteristics set or changed in such a manner as to encode information in the signal.
- machine-readable medium means the same thing and may be used interchangeably in this disclosure.
- the terms are defined to include both machine-storage media and signal media.
- the terms include both storage devices/media and carrier waves/modulated data signals.
- the instructions 824 may further be transmitted or received over a communication network 826 using a transmission medium via the network interface device 820 and utilizing any one of a number of well-known transfer protocols (e.g., HTTP).
- Examples of communication networks 826 include a local area network (LAN), a wide area network (WAN), the Internet, mobile telephone networks, plain old telephone service (POTS) networks, and wireless data networks (e.g., Wi-Fi, LTE, and WiMAX networks).
- POTS plain old telephone service
- wireless data networks e.g., Wi-Fi, LTE, and WiMAX networks.
- transmission medium or “signal medium” shall be taken to include any intangible medium that is capable of storing, encoding, or carrying the instructions 824 for execution by the machine 800 , and includes digital or analog communications signals or other intangible media to facilitate communication of such software.
- Modules may constitute either software modules (e.g., code embodied on a machine-storage medium 822 or in a signal medium) or hardware modules.
- a “hardware module” is a tangible unit capable of performing certain operations and may be configured or arranged in a certain physical manner.
- one or more computer systems e.g., a standalone computer system, a client computer system, or a server computer system
- one or more hardware modules of a computer system e.g., a processor 802 or a group of processors 802
- software e.g., an application or application portion
- a hardware module may be implemented mechanically, electronically, or any suitable combination thereof.
- a hardware module may include dedicated circuitry or logic that is permanently configured to perform certain operations.
- a hardware module may be a special-purpose processor, such as an FPGA or an ASIC.
- a hardware module may also include programmable logic or circuitry that is temporarily configured by software to perform certain operations.
- a hardware module may include software encompassed within a general-purpose processor or other programmable processor. It will be appreciated that the decision to implement a hardware module mechanically, in dedicated and permanently configured circuitry, or in temporarily configured circuitry (e.g., configured by software) may be driven by cost and time considerations.
- hardware module should be understood to encompass a tangible entity, be that an entity that is physically constructed, permanently configured (e.g., hardwired), or temporarily configured (e.g., programmed) to operate in a certain manner or to perform certain operations described herein.
- “hardware-implemented module” refers to a hardware module. Considering embodiments in which hardware modules are temporarily configured (e.g., programmed), each of the hardware modules need not be configured or instantiated at any one instance in time. For example, where a hardware module comprises a general-purpose processor configured by software to become a special-purpose processor, the general-purpose processor may be configured as respectively different special-purpose processors (e.g., comprising different hardware modules) at different times. Software may accordingly configure a processor, for example, to constitute a particular hardware module at one instance of time and to constitute a different hardware module at a different instance of time.
- processors may be temporarily configured (e.g., by software) or permanently configured to perform the relevant operations. Whether temporarily or permanently configured, such processors may constitute processor-implemented modules that operate to perform one or more operations or functions described herein.
- processor-implemented module refers to a hardware module implemented using one or more processors.
- the methods described herein may be at least partially processor-implemented, a processor being an example of hardware.
- a processor being an example of hardware.
- the operations of a method may be performed by one or more processors or processor-implemented modules.
- the one or more processors may also operate to support performance of the relevant operations in a “cloud computing” environment or as a “software as a service” (SaaS).
- SaaS software as a service
- at least some of the operations may be performed by a group of computers (as examples of machines including processors), with these operations being accessible via a network (e.g., the Internet) and via one or more appropriate interfaces (e.g., an application programming interface (API)).
- API application programming interface
- the performance of certain of the operations may be distributed among the one or more processors, not only residing within a single machine, but deployed across a number of machines.
- the one or more processors or processor-implemented modules may be located in a single geographic location (e.g., within a home environment, an office environment, or a server farm). In other example embodiments, the one or more processors or processor-implemented modules may be distributed across a number of geographic locations.
- Example 1 is a method for detecting ransomware in a storage account at a cloud server. The method comprises:
- example 2 the subject matter of example 1 can optionally include:
- example 3 the subject matter of example 1 can optionally include:
- example 4 the subject matter of example 3 can optionally include:
- example 5 the subject matter of example 1 can optionally include:
- ransomware confirmation in response to the request, the ransomware confirmation indicating a confirmation of the presence or an absence of the ransomware activity in the storage account
- the machine learning system configured to identify ransomware activity in the storage account of the cloud storage server.
- example 6 the subject matter of example 1 can optionally include wherein detecting the ransomware activity is based on a client-based malware notification from a client-based malware application operating at the client device.
- example 7 the subject matter of example 1 can optionally include wherein detecting the ransomware activity is based on a second ransomware confirmation from a second client device, the second ransomware confirmation indicating a confirmation of a presence of ransomware activity in files stored in a second storage account associated with the second client device in the cloud storage server.
- example 8 the subject matter of example 7 can optionally include wherein the files in the second storage account share similar features with the files in the storage account.
- example 9 the subject matter of example 8 can optionally include wherein the file churn of the storage account is at least equal to a file churn in the second storage account, wherein the number of files being encrypted in the storage account within the predefined period of time is at least equal to a number of files being encrypted in the second storage account within the predefined period of time, wherein the name extension and the naming pattern for the one or more files in the storage account are the same as a name extension and a naming pattern for one or more files in the second storage account.
- example 10 the subject matter of example 1 can optionally include wherein the one or more remediation options comprise recovering the one or more files to a version associated with one of a plurality of recovery times prior to a detection time of the ransomware activity, and recovering the one or more files from a recycle bin of the storage account.
- the one or more remediation options comprise recovering the one or more files to a version associated with one of a plurality of recovery times prior to a detection time of the ransomware activity, and recovering the one or more files from a recycle bin of the storage account.
- Example 11 is a system for detecting ransomware in a storage of a server.
- the system includes one or more hardware processors; and a memory storing instructions that, when executed by the one or more hardware processors, cause the one or more hardware processors to perform operations comprising:
- example 12 the subject matter of example 11 can optionally include wherein the operations further comprise:
- example 13 the subject matter of example 11 can optionally include wherein determining the features of the files comprises:
- example 14 the subject matter of example 13 can optionally include wherein detecting the ransomware activity comprises:
- example 15 the subject matter of example 11 can optionally include wherein the operations further comprise:
- ransomware confirmation in response to the request, the ransomware confirmation indicating a confirmation of the presence or an absence of the ransomware activity in the storage account
- the machine learning system configured to identify ransomware activity in the storage account of the cloud storage server.
- example 16 the subject matter of example 11 can optionally include wherein detecting the ransomware activity is based on a client-based malware notification from a client-based malware application operating at the client device.
- example 17 the subject matter of example 11 can optionally include wherein detecting the ransomware activity is based on a second ransomware confirmation from a second client device, the second ransomware confirmation indicating a confirmation of a presence of ransomware activity in files stored in a second storage account associated with the second client device in the cloud storage server.
- example 18 the subject matter of example 17 can optionally include wherein the file churn of the storage account is at least equal to a file churn in the second storage account, wherein the number of files being encrypted in the storage account within the predefined period of time is at least equal to a number of files being encrypted in the second storage account within the predefined period of time, wherein the name extension and the naming pattern for the one or more files in the storage account are the same as a name extension and a naming pattern for one or more files in the second storage account.
- example 19 the subject matter of example 11 can optionally include wherein the one or more remediation options comprise recovering the one or more files to a version associated with one of a plurality of recovery times prior to a detection time of the ransomware activity, and recovering the one or more files from a recycle bin of the storage account.
- the one or more remediation options comprise recovering the one or more files to a version associated with one of a plurality of recovery times prior to a detection time of the ransomware activity, and recovering the one or more files from a recycle bin of the storage account.
- Example 20 is a machine-storage medium storing instructions that, when executed by one or more processors of a machine, cause the one or more processors to perform operations comprising:
Landscapes
- Engineering & Computer Science (AREA)
- Computer Security & Cryptography (AREA)
- General Engineering & Computer Science (AREA)
- Theoretical Computer Science (AREA)
- Computer Hardware Design (AREA)
- Software Systems (AREA)
- General Physics & Mathematics (AREA)
- Physics & Mathematics (AREA)
- Health & Medical Sciences (AREA)
- Virology (AREA)
- Computing Systems (AREA)
- General Health & Medical Sciences (AREA)
- Signal Processing (AREA)
- Computer Networks & Wireless Communication (AREA)
- Data Mining & Analysis (AREA)
- Databases & Information Systems (AREA)
- Human Computer Interaction (AREA)
- Artificial Intelligence (AREA)
- Computer Vision & Pattern Recognition (AREA)
- Evolutionary Computation (AREA)
- Medical Informatics (AREA)
- Mathematical Physics (AREA)
- Information Retrieval, Db Structures And Fs Structures Therefor (AREA)
- Retry When Errors Occur (AREA)
- Management, Administration, Business Operations System, And Electronic Commerce (AREA)
Abstract
Description
receiving, from the client device, a remediation option selected from the one or more remediation options; and
recovering one or more files in the storage account based on the selected remediation option.
receiving, from the client device, a remediation option selected from the one or more remediation options; and
recovering one or more files in the storage account based on the selected remediation option.
receiving, from the client device, a remediation option selected from the one or more remediation options; and
recovering one or more files in the storage account based on the selected remediation option.
Claims (20)
Priority Applications (4)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/941,243 US10769278B2 (en) | 2018-03-30 | 2018-03-30 | Service identification of ransomware impact at account level |
PCT/US2019/023775 WO2019190939A1 (en) | 2018-03-30 | 2019-03-23 | Service identification of ransomware impact at account level |
CN201980022614.0A CN111919427B (en) | 2018-03-30 | 2019-03-23 | Account level Lego software affected service identification |
EP19716049.2A EP3777076B1 (en) | 2018-03-30 | 2019-03-23 | Service identification of ransomware impact at account level |
Applications Claiming Priority (1)
Application Number | Priority Date | Filing Date | Title |
---|---|---|---|
US15/941,243 US10769278B2 (en) | 2018-03-30 | 2018-03-30 | Service identification of ransomware impact at account level |
Publications (2)
Publication Number | Publication Date |
---|---|
US20190303573A1 US20190303573A1 (en) | 2019-10-03 |
US10769278B2 true US10769278B2 (en) | 2020-09-08 |
Family
ID=66049725
Family Applications (1)
Application Number | Title | Priority Date | Filing Date |
---|---|---|---|
US15/941,243 Active 2038-11-29 US10769278B2 (en) | 2018-03-30 | 2018-03-30 | Service identification of ransomware impact at account level |
Country Status (4)
Country | Link |
---|---|
US (1) | US10769278B2 (en) |
EP (1) | EP3777076B1 (en) |
CN (1) | CN111919427B (en) |
WO (1) | WO2019190939A1 (en) |
Cited By (3)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11336685B1 (en) * | 2021-12-22 | 2022-05-17 | Nasuni Corporation | Cloud-native global file system with rapid ransomware recovery |
US11489852B2 (en) * | 2019-02-26 | 2022-11-01 | Alsid | Method for protecting a private computer network |
US11645383B2 (en) * | 2017-01-11 | 2023-05-09 | Morphisec Information Security 2014 Ltd. | Early runtime detection and prevention of ransomware |
Families Citing this family (31)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11120133B2 (en) * | 2017-11-07 | 2021-09-14 | Spinbackup Inc. | Ransomware protection for cloud storage systems |
US11010233B1 (en) | 2018-01-18 | 2021-05-18 | Pure Storage, Inc | Hardware-based system monitoring |
US11308207B2 (en) | 2018-03-30 | 2022-04-19 | Microsoft Technology Licensing, Llc | User verification of malware impacted files |
US11200320B2 (en) | 2018-03-30 | 2021-12-14 | Microsoft Technology Licensing, Llc | Coordinating service ransomware detection with client-side ransomware detection |
US10963564B2 (en) | 2018-03-30 | 2021-03-30 | Microsoft Technology Licensing, Llc | Selection of restore point based on detection of malware attack |
US10917416B2 (en) | 2018-03-30 | 2021-02-09 | Microsoft Technology Licensing, Llc | Service identification of ransomware impacted files |
US20190362075A1 (en) * | 2018-05-22 | 2019-11-28 | Fortinet, Inc. | Preventing users from accessing infected files by using multiple file storage repositories and a secure data transfer agent logically interposed therebetween |
US20200067975A1 (en) * | 2018-08-27 | 2020-02-27 | Box, Inc. | Ransomware remediation in collaboration environments |
US11036856B2 (en) | 2018-09-16 | 2021-06-15 | Fortinet, Inc. | Natively mounting storage for inspection and sandboxing in the cloud |
US11711310B2 (en) | 2019-09-18 | 2023-07-25 | Tweenznet Ltd. | System and method for determining a network performance property in at least one network |
US11418547B2 (en) | 2019-10-22 | 2022-08-16 | Microsoft Technology Licensing, Llc | Common framework for translating customer feedback to standard and shareable policy changes of cloud threat detection service |
US11625481B2 (en) | 2019-11-22 | 2023-04-11 | Pure Storage, Inc. | Selective throttling of operations potentially related to a security threat to a storage system |
US11645162B2 (en) * | 2019-11-22 | 2023-05-09 | Pure Storage, Inc. | Recovery point determination for data restoration in a storage system |
US11675898B2 (en) | 2019-11-22 | 2023-06-13 | Pure Storage, Inc. | Recovery dataset management for security threat monitoring |
US11500788B2 (en) | 2019-11-22 | 2022-11-15 | Pure Storage, Inc. | Logical address based authorization of operations with respect to a storage system |
US11651075B2 (en) | 2019-11-22 | 2023-05-16 | Pure Storage, Inc. | Extensible attack monitoring by a storage system |
US11941116B2 (en) | 2019-11-22 | 2024-03-26 | Pure Storage, Inc. | Ransomware-based data protection parameter modification |
US20210383010A1 (en) * | 2019-11-22 | 2021-12-09 | Pure Storage, Inc. | Measurement Interval Anomaly Detection-based Generation of Snapshots |
US11615185B2 (en) | 2019-11-22 | 2023-03-28 | Pure Storage, Inc. | Multi-layer security threat detection for a storage system |
US11755751B2 (en) | 2019-11-22 | 2023-09-12 | Pure Storage, Inc. | Modify access restrictions in response to a possible attack against data stored by a storage system |
US11341236B2 (en) * | 2019-11-22 | 2022-05-24 | Pure Storage, Inc. | Traffic-based detection of a security threat to a storage system |
US11720714B2 (en) | 2019-11-22 | 2023-08-08 | Pure Storage, Inc. | Inter-I/O relationship based detection of a security threat to a storage system |
US11520907B1 (en) | 2019-11-22 | 2022-12-06 | Pure Storage, Inc. | Storage system snapshot retention based on encrypted data |
US11657155B2 (en) * | 2019-11-22 | 2023-05-23 | Pure Storage, Inc | Snapshot delta metric based determination of a possible ransomware attack against data maintained by a storage system |
US11687418B2 (en) | 2019-11-22 | 2023-06-27 | Pure Storage, Inc. | Automatic generation of recovery plans specific to individual storage elements |
US11720692B2 (en) | 2019-11-22 | 2023-08-08 | Pure Storage, Inc. | Hardware token based management of recovery datasets for a storage system |
US11716338B2 (en) * | 2019-11-26 | 2023-08-01 | Tweenznet Ltd. | System and method for determining a file-access pattern and detecting ransomware attacks in at least one computer network |
US11227053B2 (en) | 2019-12-10 | 2022-01-18 | Micro Focus Llc | Malware management using I/O correlation coefficients |
CN112861133A (en) * | 2021-02-19 | 2021-05-28 | 智巡密码(上海)检测技术有限公司 | Lesog software judgment and detection method based on randomness threshold |
US20230267207A1 (en) * | 2022-02-18 | 2023-08-24 | Halcyon Tech, Inc. | Antiransomware Using Machine Learning |
US20230333771A1 (en) * | 2022-04-19 | 2023-10-19 | Dell Products L.P. | Attribute-only reading of specified data |
Citations (71)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20060137010A1 (en) | 2004-12-21 | 2006-06-22 | Microsoft Corporation | Method and system for a self-healing device |
US20070006304A1 (en) | 2005-06-30 | 2007-01-04 | Microsoft Corporation | Optimizing malware recovery |
US7756834B2 (en) | 2005-11-03 | 2010-07-13 | I365 Inc. | Malware and spyware attack recovery system and method |
US7784098B1 (en) | 2005-07-14 | 2010-08-24 | Trend Micro, Inc. | Snapshot and restore technique for computer system recovery |
US20110082838A1 (en) | 2009-10-07 | 2011-04-07 | F-Secure Oyj | Computer security method and apparatus |
US20120124007A1 (en) | 2010-11-16 | 2012-05-17 | F-Secure Corporation | Disinfection of a file system |
US20130024435A1 (en) | 2011-07-19 | 2013-01-24 | Exagrid Systems, Inc. | Systems and methods for managing delta version chains |
US20130067576A1 (en) | 2011-09-13 | 2013-03-14 | F-Secure Corporation | Restoration of file damage caused by malware |
US20130086683A1 (en) | 2011-09-29 | 2013-04-04 | Microsoft Corporation | Selectively scanning objects for infection by malware |
US8468604B2 (en) | 2005-08-16 | 2013-06-18 | Emc Corporation | Method and system for detecting malware |
US8484737B1 (en) | 2008-11-10 | 2013-07-09 | Symantec Corporation | Techniques for processing backup data for identifying and handling content |
US20140047544A1 (en) | 2012-08-09 | 2014-02-13 | Bjorn Markus Jakobsson | Server-Side Malware Detection and Classification |
US8667583B2 (en) | 2008-09-22 | 2014-03-04 | Microsoft Corporation | Collecting and analyzing malware data |
US20140130161A1 (en) | 2012-05-11 | 2014-05-08 | Kaspersky Lab Zao | System and Method for Cloud-Based Detection of Computer Malware |
US8813222B1 (en) | 2009-01-21 | 2014-08-19 | Bitdefender IPR Management Ltd. | Collaborative malware scanning |
US8881282B1 (en) | 2004-04-01 | 2014-11-04 | Fireeye, Inc. | Systems and methods for malware attack detection and identification |
US20150172304A1 (en) | 2013-12-16 | 2015-06-18 | Malwarebytes Corporation | Secure backup with anti-malware scan |
US20150178171A1 (en) | 2013-12-24 | 2015-06-25 | International Business Machines Corporation | File corruption recovery in concurrent data protection |
US9317686B1 (en) | 2013-07-16 | 2016-04-19 | Trend Micro Inc. | File backup to combat ransomware |
US20160124665A1 (en) | 2014-11-04 | 2016-05-05 | Rubrik, Inc. | Management of virtual machine snapshots |
US20160164894A1 (en) | 2014-12-03 | 2016-06-09 | Guardicore Ltd. | Automatic network attack detection and remediation using information collected by honeypots |
US9405902B1 (en) | 2011-03-15 | 2016-08-02 | Trend Micro Incorporated | Anti-malware service in multi-tenant cloud computing environments |
US20160294851A1 (en) | 2015-03-31 | 2016-10-06 | Juniper Networks, Inc. | Detecting a malicious file infection via sandboxing |
US9514309B1 (en) | 2014-04-30 | 2016-12-06 | Symantec Corporation | Systems and methods for protecting files from malicious encryption attempts |
WO2017053745A1 (en) | 2015-09-23 | 2017-03-30 | University Of Florida Research Foundation, Incorporated | Malware detection via data transformation monitoring |
CN106570396A (en) | 2016-12-29 | 2017-04-19 | 哈尔滨安天科技股份有限公司 | System and method for preventing data from being encrypted by ransomware |
US20170140156A1 (en) | 2015-11-12 | 2017-05-18 | Symantec Corporation | Systems and methods for protecting backed-up data from ransomware attacks |
US20170177867A1 (en) | 2015-12-16 | 2017-06-22 | Carbonite, Inc. | Systems and methods for automatic snapshotting of backups based on malicious modification detection |
US20170180394A1 (en) * | 2015-12-16 | 2017-06-22 | Carbonite, Inc. | Systems and methods for automatic detection of malicious activity via common files |
US20170206353A1 (en) * | 2016-01-19 | 2017-07-20 | Hope Bay Technologies, Inc. | Method and system for preventing malicious alteration of data in computer system |
US20170223031A1 (en) * | 2016-02-01 | 2017-08-03 | Symantec Corporation | Systems and methods for modifying file backups in response to detecting potential ransomware |
US9734337B1 (en) | 2017-01-24 | 2017-08-15 | Malwarebytes Inc. | Behavior-based ransomware detection |
US9756061B1 (en) | 2016-11-18 | 2017-09-05 | Extrahop Networks, Inc. | Detecting attacks using passive network monitoring |
US20170270293A1 (en) | 2016-03-15 | 2017-09-21 | Symantec Corporation | Systems and methods for generating tripwire files |
US9792436B1 (en) | 2013-04-29 | 2017-10-17 | Symantec Corporation | Techniques for remediating an infected file |
US20170324755A1 (en) | 2016-05-03 | 2017-11-09 | Check Point Software Technologies Ltd. | Method and System for Mitigating the Effects of Ransomware |
US20170329965A1 (en) | 2013-09-13 | 2017-11-16 | Elasticsearch B.V. | Detecting Irregularities on a Device |
US9838405B1 (en) | 2015-11-20 | 2017-12-05 | Symantec Corporation | Systems and methods for determining types of malware infections on computing devices |
US20170364681A1 (en) | 2016-06-21 | 2017-12-21 | Acronis International Gmbh | Methods of preserving and protecting user data from modification or loss due to malware |
US20170371547A1 (en) | 2016-06-28 | 2017-12-28 | International Business Machines Corporation | File level access to block level incremental backups of a virtual disk |
WO2018004891A1 (en) | 2016-07-01 | 2018-01-04 | Mcafee, Inc. | Ransomware protection for cloud file storage |
US20180018458A1 (en) | 2016-07-14 | 2018-01-18 | Mcafee, Inc. | Mitigation of ransomware |
US20180027009A1 (en) | 2016-07-20 | 2018-01-25 | Cisco Technology, Inc. | Automated container security |
US20180024893A1 (en) | 2016-07-25 | 2018-01-25 | Cisco Technology, Inc. | Intelligent backup system |
US20180034835A1 (en) * | 2016-07-26 | 2018-02-01 | Microsoft Technology Licensing, Llc | Remediation for ransomware attacks on cloud drive folders |
US20180048658A1 (en) | 2016-08-10 | 2018-02-15 | Netskope, Inc. | Systems and methods of detecting and responding to malware on a file system |
US20180101678A1 (en) | 2016-10-10 | 2018-04-12 | Stephen Rosa | Method and System for Countering Ransomware |
US10009360B1 (en) | 2016-03-25 | 2018-06-26 | EMC IP Holding Company LLC | Malware detection and data protection integration |
US10007795B1 (en) | 2014-02-13 | 2018-06-26 | Trend Micro Incorporated | Detection and recovery of documents that have been compromised by malware |
US20180181761A1 (en) | 2016-12-28 | 2018-06-28 | Bidan Sinha | Method for ransomware impact assessment and remediation assisted by data compression |
US20180203997A1 (en) | 2017-01-19 | 2018-07-19 | International Business Machines Corporation | Protecting backup files from malware |
US20180211038A1 (en) | 2016-01-24 | 2018-07-26 | Minerva Labs Ltd. | Ransomware attack remediation |
US10055582B1 (en) | 2016-09-19 | 2018-08-21 | EMC IP Holding Company LLC | Automated detection and remediation of ransomware attacks involving a storage device of a computer network |
US20180248896A1 (en) | 2017-02-24 | 2018-08-30 | Zitovault Software, Inc. | System and method to prevent, detect, thwart, and recover automatically from ransomware cyber attacks, using behavioral analysis and machine learning |
US20180293379A1 (en) | 2017-04-05 | 2018-10-11 | Asher Dahan | System and Method for Blocking Ransomware Infections |
US10140454B1 (en) | 2015-09-29 | 2018-11-27 | Symantec Corporation | Systems and methods for restarting computing devices into security-application-configured safe modes |
US20180357133A1 (en) | 2017-06-12 | 2018-12-13 | Acronis International Gmbh | Anti-malware protection using volume filters |
US20180375826A1 (en) | 2017-06-23 | 2018-12-27 | Sheng-Hsiung Chang | Active network backup device |
US20190065745A1 (en) | 2017-08-31 | 2019-02-28 | International Business Machines Corporation | Integrity, theft protection and cyber deception using a deception-based filesystem |
US20190109870A1 (en) * | 2017-09-14 | 2019-04-11 | Commvault Systems, Inc. | Ransomware detection and intelligent restore |
US20190130097A1 (en) | 2017-10-26 | 2019-05-02 | Western Digital Technologies, Inc. | Device-based anti-malware |
US20190138727A1 (en) | 2017-11-07 | 2019-05-09 | Spinbackup Inc. | Ransomware Protection for Cloud Storage Systems |
US20190158512A1 (en) * | 2017-11-20 | 2019-05-23 | Fortinet, Inc. | Lightweight anti-ransomware system |
US20190201597A1 (en) | 2017-12-28 | 2019-07-04 | Ethicon Llc | Dual in-series large and small droplet filters |
US20190228148A1 (en) | 2018-01-22 | 2019-07-25 | International Business Machines Corporation | Ransomware resetter |
US10409986B1 (en) | 2016-09-26 | 2019-09-10 | EMC IP Holding Company LLC | Ransomware detection in a continuous data protection environment |
US20190303572A1 (en) | 2018-03-30 | 2019-10-03 | Microsoft Technology Licensing, Llc | Selection of restore point based on detection of malware attack |
US20190306179A1 (en) | 2018-03-30 | 2019-10-03 | Microsoft Technology Licensing, Llc | Service identification of ransomware impacted files |
US20190303575A1 (en) | 2018-03-30 | 2019-10-03 | Microsoft Technology Licensing, Llc | Coordinating service ransomware detection with client-side ransomware detection |
US20190303571A1 (en) | 2018-03-30 | 2019-10-03 | Microsoft Technology Licensing, Llc | User verification of malware impacted files |
US20190347419A1 (en) | 2017-05-03 | 2019-11-14 | Tencent Technology (Shenzhen) Company Limited | Virus program cleanup method, storage medium and electronic terminal |
Family Cites Families (1)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US20140379637A1 (en) * | 2013-06-25 | 2014-12-25 | Microsoft Corporation | Reverse replication to rollback corrupted files |
-
2018
- 2018-03-30 US US15/941,243 patent/US10769278B2/en active Active
-
2019
- 2019-03-23 WO PCT/US2019/023775 patent/WO2019190939A1/en active Application Filing
- 2019-03-23 EP EP19716049.2A patent/EP3777076B1/en active Active
- 2019-03-23 CN CN201980022614.0A patent/CN111919427B/en active Active
Patent Citations (77)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US8881282B1 (en) | 2004-04-01 | 2014-11-04 | Fireeye, Inc. | Systems and methods for malware attack detection and identification |
US7624443B2 (en) | 2004-12-21 | 2009-11-24 | Microsoft Corporation | Method and system for a self-heating device |
US20060137010A1 (en) | 2004-12-21 | 2006-06-22 | Microsoft Corporation | Method and system for a self-healing device |
US20070006304A1 (en) | 2005-06-30 | 2007-01-04 | Microsoft Corporation | Optimizing malware recovery |
US7784098B1 (en) | 2005-07-14 | 2010-08-24 | Trend Micro, Inc. | Snapshot and restore technique for computer system recovery |
US8468604B2 (en) | 2005-08-16 | 2013-06-18 | Emc Corporation | Method and system for detecting malware |
US7756834B2 (en) | 2005-11-03 | 2010-07-13 | I365 Inc. | Malware and spyware attack recovery system and method |
US8667583B2 (en) | 2008-09-22 | 2014-03-04 | Microsoft Corporation | Collecting and analyzing malware data |
US8484737B1 (en) | 2008-11-10 | 2013-07-09 | Symantec Corporation | Techniques for processing backup data for identifying and handling content |
US8813222B1 (en) | 2009-01-21 | 2014-08-19 | Bitdefender IPR Management Ltd. | Collaborative malware scanning |
US20110082838A1 (en) | 2009-10-07 | 2011-04-07 | F-Secure Oyj | Computer security method and apparatus |
US20120124007A1 (en) | 2010-11-16 | 2012-05-17 | F-Secure Corporation | Disinfection of a file system |
US9405902B1 (en) | 2011-03-15 | 2016-08-02 | Trend Micro Incorporated | Anti-malware service in multi-tenant cloud computing environments |
US20130024435A1 (en) | 2011-07-19 | 2013-01-24 | Exagrid Systems, Inc. | Systems and methods for managing delta version chains |
US20130067576A1 (en) | 2011-09-13 | 2013-03-14 | F-Secure Corporation | Restoration of file damage caused by malware |
US20130086683A1 (en) | 2011-09-29 | 2013-04-04 | Microsoft Corporation | Selectively scanning objects for infection by malware |
US20140130161A1 (en) | 2012-05-11 | 2014-05-08 | Kaspersky Lab Zao | System and Method for Cloud-Based Detection of Computer Malware |
US8875294B2 (en) | 2012-05-11 | 2014-10-28 | Kaspersky Lab Zao | System and method for cloud-based detection of computer malware |
US20140047544A1 (en) | 2012-08-09 | 2014-02-13 | Bjorn Markus Jakobsson | Server-Side Malware Detection and Classification |
US9411955B2 (en) | 2012-08-09 | 2016-08-09 | Qualcomm Incorporated | Server-side malware detection and classification |
US9792436B1 (en) | 2013-04-29 | 2017-10-17 | Symantec Corporation | Techniques for remediating an infected file |
US9317686B1 (en) | 2013-07-16 | 2016-04-19 | Trend Micro Inc. | File backup to combat ransomware |
US20170329965A1 (en) | 2013-09-13 | 2017-11-16 | Elasticsearch B.V. | Detecting Irregularities on a Device |
US20150172304A1 (en) | 2013-12-16 | 2015-06-18 | Malwarebytes Corporation | Secure backup with anti-malware scan |
US20150178171A1 (en) | 2013-12-24 | 2015-06-25 | International Business Machines Corporation | File corruption recovery in concurrent data protection |
US10007795B1 (en) | 2014-02-13 | 2018-06-26 | Trend Micro Incorporated | Detection and recovery of documents that have been compromised by malware |
US9852289B1 (en) | 2014-04-30 | 2017-12-26 | Symantec Corporation | Systems and methods for protecting files from malicious encryption attempts |
US9514309B1 (en) | 2014-04-30 | 2016-12-06 | Symantec Corporation | Systems and methods for protecting files from malicious encryption attempts |
US20160124665A1 (en) | 2014-11-04 | 2016-05-05 | Rubrik, Inc. | Management of virtual machine snapshots |
US20160164894A1 (en) | 2014-12-03 | 2016-06-09 | Guardicore Ltd. | Automatic network attack detection and remediation using information collected by honeypots |
US9680845B2 (en) | 2015-03-31 | 2017-06-13 | Juniper Neworks, Inc. | Detecting a malicious file infection via sandboxing |
US20160294851A1 (en) | 2015-03-31 | 2016-10-06 | Juniper Networks, Inc. | Detecting a malicious file infection via sandboxing |
WO2017053745A1 (en) | 2015-09-23 | 2017-03-30 | University Of Florida Research Foundation, Incorporated | Malware detection via data transformation monitoring |
US10140454B1 (en) | 2015-09-29 | 2018-11-27 | Symantec Corporation | Systems and methods for restarting computing devices into security-application-configured safe modes |
US20170140156A1 (en) | 2015-11-12 | 2017-05-18 | Symantec Corporation | Systems and methods for protecting backed-up data from ransomware attacks |
US9838405B1 (en) | 2015-11-20 | 2017-12-05 | Symantec Corporation | Systems and methods for determining types of malware infections on computing devices |
US20170177867A1 (en) | 2015-12-16 | 2017-06-22 | Carbonite, Inc. | Systems and methods for automatic snapshotting of backups based on malicious modification detection |
US20170180394A1 (en) * | 2015-12-16 | 2017-06-22 | Carbonite, Inc. | Systems and methods for automatic detection of malicious activity via common files |
US20170206353A1 (en) * | 2016-01-19 | 2017-07-20 | Hope Bay Technologies, Inc. | Method and system for preventing malicious alteration of data in computer system |
US20180211038A1 (en) | 2016-01-24 | 2018-07-26 | Minerva Labs Ltd. | Ransomware attack remediation |
US20170223031A1 (en) * | 2016-02-01 | 2017-08-03 | Symantec Corporation | Systems and methods for modifying file backups in response to detecting potential ransomware |
US20170270293A1 (en) | 2016-03-15 | 2017-09-21 | Symantec Corporation | Systems and methods for generating tripwire files |
US10009360B1 (en) | 2016-03-25 | 2018-06-26 | EMC IP Holding Company LLC | Malware detection and data protection integration |
US20170324755A1 (en) | 2016-05-03 | 2017-11-09 | Check Point Software Technologies Ltd. | Method and System for Mitigating the Effects of Ransomware |
US20170364681A1 (en) | 2016-06-21 | 2017-12-21 | Acronis International Gmbh | Methods of preserving and protecting user data from modification or loss due to malware |
US20170371547A1 (en) | 2016-06-28 | 2017-12-28 | International Business Machines Corporation | File level access to block level incremental backups of a virtual disk |
WO2018004891A1 (en) | 2016-07-01 | 2018-01-04 | Mcafee, Inc. | Ransomware protection for cloud file storage |
US20180007069A1 (en) | 2016-07-01 | 2018-01-04 | Mcafee, Inc. | Ransomware Protection For Cloud File Storage |
US20180018458A1 (en) | 2016-07-14 | 2018-01-18 | Mcafee, Inc. | Mitigation of ransomware |
US20180027009A1 (en) | 2016-07-20 | 2018-01-25 | Cisco Technology, Inc. | Automated container security |
US20180024893A1 (en) | 2016-07-25 | 2018-01-25 | Cisco Technology, Inc. | Intelligent backup system |
US20180034835A1 (en) * | 2016-07-26 | 2018-02-01 | Microsoft Technology Licensing, Llc | Remediation for ransomware attacks on cloud drive folders |
US20180048658A1 (en) | 2016-08-10 | 2018-02-15 | Netskope, Inc. | Systems and methods of detecting and responding to malware on a file system |
US10055582B1 (en) | 2016-09-19 | 2018-08-21 | EMC IP Holding Company LLC | Automated detection and remediation of ransomware attacks involving a storage device of a computer network |
US10409986B1 (en) | 2016-09-26 | 2019-09-10 | EMC IP Holding Company LLC | Ransomware detection in a continuous data protection environment |
US20180101678A1 (en) | 2016-10-10 | 2018-04-12 | Stephen Rosa | Method and System for Countering Ransomware |
US9756061B1 (en) | 2016-11-18 | 2017-09-05 | Extrahop Networks, Inc. | Detecting attacks using passive network monitoring |
US20180181761A1 (en) | 2016-12-28 | 2018-06-28 | Bidan Sinha | Method for ransomware impact assessment and remediation assisted by data compression |
CN106570396A (en) | 2016-12-29 | 2017-04-19 | 哈尔滨安天科技股份有限公司 | System and method for preventing data from being encrypted by ransomware |
US20180203997A1 (en) | 2017-01-19 | 2018-07-19 | International Business Machines Corporation | Protecting backup files from malware |
US9734337B1 (en) | 2017-01-24 | 2017-08-15 | Malwarebytes Inc. | Behavior-based ransomware detection |
US20180248896A1 (en) | 2017-02-24 | 2018-08-30 | Zitovault Software, Inc. | System and method to prevent, detect, thwart, and recover automatically from ransomware cyber attacks, using behavioral analysis and machine learning |
US20180293379A1 (en) | 2017-04-05 | 2018-10-11 | Asher Dahan | System and Method for Blocking Ransomware Infections |
US20190347419A1 (en) | 2017-05-03 | 2019-11-14 | Tencent Technology (Shenzhen) Company Limited | Virus program cleanup method, storage medium and electronic terminal |
US20180357133A1 (en) | 2017-06-12 | 2018-12-13 | Acronis International Gmbh | Anti-malware protection using volume filters |
US20180375826A1 (en) | 2017-06-23 | 2018-12-27 | Sheng-Hsiung Chang | Active network backup device |
US20190065745A1 (en) | 2017-08-31 | 2019-02-28 | International Business Machines Corporation | Integrity, theft protection and cyber deception using a deception-based filesystem |
US20190109870A1 (en) * | 2017-09-14 | 2019-04-11 | Commvault Systems, Inc. | Ransomware detection and intelligent restore |
US20190130097A1 (en) | 2017-10-26 | 2019-05-02 | Western Digital Technologies, Inc. | Device-based anti-malware |
US20190138727A1 (en) | 2017-11-07 | 2019-05-09 | Spinbackup Inc. | Ransomware Protection for Cloud Storage Systems |
US20190158512A1 (en) * | 2017-11-20 | 2019-05-23 | Fortinet, Inc. | Lightweight anti-ransomware system |
US20190201597A1 (en) | 2017-12-28 | 2019-07-04 | Ethicon Llc | Dual in-series large and small droplet filters |
US20190228148A1 (en) | 2018-01-22 | 2019-07-25 | International Business Machines Corporation | Ransomware resetter |
US20190303572A1 (en) | 2018-03-30 | 2019-10-03 | Microsoft Technology Licensing, Llc | Selection of restore point based on detection of malware attack |
US20190306179A1 (en) | 2018-03-30 | 2019-10-03 | Microsoft Technology Licensing, Llc | Service identification of ransomware impacted files |
US20190303575A1 (en) | 2018-03-30 | 2019-10-03 | Microsoft Technology Licensing, Llc | Coordinating service ransomware detection with client-side ransomware detection |
US20190303571A1 (en) | 2018-03-30 | 2019-10-03 | Microsoft Technology Licensing, Llc | User verification of malware impacted files |
Non-Patent Citations (16)
Title |
---|
"Client Server Security", Retrieved from: http://docs.trendmicro.com/all/smb/css/v3.6/en-us/css_3.6_gsg.pdf, Mar. 2007, 93 Pages. |
"Data Backup and recovery", Retrieved from <<https://www.pcrisk.com/how-to-remove-spyware/data-backup-and-recovery>>, Retrieved on Feb. 5, 2018, 6 Pages. |
"Eset vs. Crypto-ransomware", In White Paper of ESET, Retrieved on: Feb. 7, 2018, 9 Pages. |
"File Type Detection and Filtration Overview", Retrieved from: https://onlinehelp.opswat.com/corev3/2.4.4._File_Type_Detection_And_Filtration_Overview.html, Retrieved Date: Feb. 5, 2018, 3 Pages. |
"International Search Report and Written Opinion Issued in PCT Application No. PCT/US2019/023772", dated May 7, 2019, 12 Pages. |
"International Search Report and Written Opinion Issued in PCT Application No. PCT/US2019/023776", dated May 14, 2019, 13 Pages. |
"International Search Report and Written Opinion Issued in PCT Patent Application No. PCT/US19/023770", dated Jun. 25, 2019, 10 Pages. |
"International Search Report and Written Opinion Issued in PCT Patent Application No. PCT/US19/023771", dated Jun. 25, 2019, 10 Pages. |
"International Search Report and Written Opinion Issued in PCT Patent Application No. PCT/US19/023775", dated Jun. 25, 2019, 10 Pages. |
"Nextcloud presents Ransomware Protection app", Retrieved from: https://help.nextcloud.com/t/nextcloud-presents-ransomware-protection-app/19255, Aug. 8, 2017, 6 Pages. |
"Non Final Office Action Issued in U.S. Appl. No. 15/941,710", dated Mar. 6, 2020, 14 Pages. |
"Non Final Office Action Issued in U.S. Appl. No. 15/941,840", dated Mar. 4, 2020, 14 Pages. |
"Non Final Office Action Issued in U.S. Appl. No. 15/942,009", dated Apr. 29, 2020, 22 Pages. |
D-Souza-Wiltshire, et al., "Configure the notifications that appear on endpoints", Retrieved from: https://docs.microsoft.com/en-us/windows/threat-protection/windows-defender-antivirus/configure-notifications-windows-defender-antivirus, Oct. 31, 2017, 5 Pages. |
Hatem, et al., "Malware Detection in Cloud Computing", In Journal of International Journal of Advanced Computer Science and Applications, vol. 5, Issue 4, 2014, pp. 187-192. |
Muthurajkumar, et al., "Agent Based Intelligent Approach for the Malware Detection for Infected Cloud Data Storage Files", In Proceedings of Seventh International Conference on Advanced Computing, Dec. 15, 2015, pp. 1-5. |
Cited By (6)
Publication number | Priority date | Publication date | Assignee | Title |
---|---|---|---|---|
US11645383B2 (en) * | 2017-01-11 | 2023-05-09 | Morphisec Information Security 2014 Ltd. | Early runtime detection and prevention of ransomware |
US11489852B2 (en) * | 2019-02-26 | 2022-11-01 | Alsid | Method for protecting a private computer network |
US11336685B1 (en) * | 2021-12-22 | 2022-05-17 | Nasuni Corporation | Cloud-native global file system with rapid ransomware recovery |
US11632394B1 (en) * | 2021-12-22 | 2023-04-18 | Nasuni Corporation | Cloud-native global file system with rapid ransomware recovery |
US20230262090A1 (en) * | 2021-12-22 | 2023-08-17 | Nasuni Corporation | Cloud-native global file system with rapid ransomware recovery |
US11930042B2 (en) * | 2021-12-22 | 2024-03-12 | Nasuni Corporation | Cloud-native global file system with rapid ransomware recovery |
Also Published As
Publication number | Publication date |
---|---|
CN111919427B (en) | 2022-09-23 |
US20190303573A1 (en) | 2019-10-03 |
EP3777076A1 (en) | 2021-02-17 |
WO2019190939A1 (en) | 2019-10-03 |
EP3777076B1 (en) | 2022-10-26 |
CN111919427A (en) | 2020-11-10 |
Similar Documents
Publication | Publication Date | Title |
---|---|---|
US10769278B2 (en) | Service identification of ransomware impact at account level | |
EP3776309B1 (en) | Selection of restore point based on detection of malware attack | |
EP3756122B1 (en) | Coordinating service ransomware detection with client-side ransomware detection | |
US11308207B2 (en) | User verification of malware impacted files | |
EP3776312B1 (en) | Service identification of ransomware impacted files | |
US9467463B2 (en) | System and method for assessing vulnerability of a mobile device | |
US11790918B2 (en) | Audio firewall | |
US20200389491A1 (en) | Mobile Device Security Using A Secure Execution Context | |
EP2605174B1 (en) | Apparatus and method for analyzing malware in data analysis system | |
US10739979B2 (en) | Histogram slider for quick navigation of a time-based list | |
CN108337208B (en) | Data protection method and replacement device based on cloud storage and cloud storage system | |
US11947779B2 (en) | User-interface driven creation and distribution of computer applications | |
US9961134B2 (en) | Methods and systems for auto-starting and auto-stopping databases | |
EP3846056B1 (en) | Methods, systems, and media for protecting computer systems from user-created objects | |
US20230222027A1 (en) | Distributed system, communication terminal, function recovery method, and program |
Legal Events
Date | Code | Title | Description |
---|---|---|---|
FEPP | Fee payment procedure |
Free format text: ENTITY STATUS SET TO UNDISCOUNTED (ORIGINAL EVENT CODE: BIG.); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY |
|
AS | Assignment |
Owner name: MICROSOFT TECHNOLOGY LICENSING, LLC, WASHINGTON Free format text: ASSIGNMENT OF ASSIGNORS INTEREST;ASSIGNORS:CHELARESCU, FILIP;THAYANITHY, PARTHIPAN;ABERGEL, MEIR E.;AND OTHERS;SIGNING DATES FROM 20180509 TO 20180605;REEL/FRAME:046013/0457 |
|
AS | Assignment |
Owner name: MICROSOFT TECHNOLOGY LICENSING, LLC, WASHINGTON Free format text: CORRECTIVE ASSIGNMENT TO CORRECT THE SECOND INVENTOR EXECUTION DATE PREVIOUSLY RECORDED AT REEL: 046013 FRAME: 0457. ASSIGNOR(S) HEREBY CONFIRMS THE ASSIGNMENT;ASSIGNORS:CHELARESCU, FILIP;THAYANITHY, PARTHIPAN;ABERGEL, MEIR E.;AND OTHERS;SIGNING DATES FROM 20180509 TO 20180605;REEL/FRAME:046364/0129 |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NON FINAL ACTION MAILED |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS |
|
STPP | Information on status: patent application and granting procedure in general |
Free format text: NOTICE OF ALLOWANCE MAILED -- APPLICATION RECEIVED IN OFFICE OF PUBLICATIONS |
|
STCF | Information on status: patent grant |
Free format text: PATENTED CASE |
|
MAFP | Maintenance fee payment |
Free format text: PAYMENT OF MAINTENANCE FEE, 4TH YEAR, LARGE ENTITY (ORIGINAL EVENT CODE: M1551); ENTITY STATUS OF PATENT OWNER: LARGE ENTITY Year of fee payment: 4 |